Description
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rybbit-io | rybbit | < 2.7.0 | 2.7.0 |
References
- GitHub Issue #1038 issue-tracking
- https://github.com/rybbit-io/rybbit product
- Vulnerable code: index.ts technical-description
- Fix commit patch
- VulnCheck Advisory: Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials third-party-advisory